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1.7.  (U)  Iraq 

1.8.  (S//NF)  Security  operations  effective  in  curbing  attacks 
on  Basrah  International  Airfield: 


1.9.  (S//NF)  DS/TIA/ITA  wishes  to  highlight  excerpts  from  a 
recent  NGA  report  reviewing  countermeasures  put  in  place  at 
the  Basrah  International  Airfield,  which  is  home  to  — among 
other  USG  contingents  mentioned  in  the  report  — a U.S. 
Regional  Embassy  Office  (REO).  REO  Basrah  has  been 
particularly  susceptible  to  indirect  fire  (IDF)  due  largely 
to  its  proximity  to  Jaysh  al-Mahdi  Special  Groups  (JAM-SG) 
and  other  Shi, a militants  for  whom  IDF,  with  its  standoff 
qualities,  remains  a weapon  of  choice. 

1.10.  (S//REL  TO  USA,  AUS , CAN,  GBR)  Between  March  and  June, 
Iraqi  Security  Forces  (ISF)  launched  a 14-phase  offensive. 
Operation  Charge  of  the  Knights,  to  regain  control  of  Basrah 
Province  from  insurgents  and  militants.  This  operation 
successfully  curbed  IDF  on  Basrah  International  Airfield  and 
effectively  ended  attacks  originating  inside  the  city  limits 
of  Basrah.  IDF  attacks  against  the  airfield  have  decreased  by 
83  percent  since  operation, s Phase  1 ended  on  April  1. 
Geospatial  intelligence  analysis  indicates  attacks 
originating  near  the  center  of  the  city  of  Basrah  have 
diminished  since  the  operation,  but  attacks  originating  north 
of  the  Qarmat  Ali  waterway  have  continued,  albeit  at  lower 
levels . 

111.  (S//REL  TO  USA,  AUS,  CAN,  GBR)  Basrah  International 
Airfield  is  home  to  Coalition  forces.  Contingency  Operating 
Base  (COB)  Basrah  and  is  the  headquarters  of  the  70th  Iraqi 
Air  Force  Squadron,  the  Iraqi  Army  14th  Division  Intelligence 


Surveillance  and  Reconnaissance  Company,  and  the  14th 
Division  Bomb  Disposal  Company.  Because  of  its  importance  to 
Coalition  forces  and  ISF,  the  airfield  has  historically  been 
a target  of  IDF  attacks  by  insurgents  and  other  militants 
since  Operation  Iraqi  Freedom  began. 

1[12.  (S//REL  TO  USA,  AUS,  CAN,  GBR)  Operation  Charge  of  the 
Knights  was  an  Iraqi  security  initiative  that  used  elements 
of  the  Iraqi  Army,  Ministry  of  Interior,  and  local  police 
forces  to  quell  insurgent  violence  in  Basrah  Province.  The 
operation  began  on  March  25,  lasted  approximately  90  days, 
and  was  executed  in  14  phases.  Although  all  phases  involved 
eradicating  violent  elements  from  the  city  of  Basrah,  several 
focused  on  securing  other  areas  of  Basrah  Province,  including 
the  cities  of  al  Qurnah,  al  Faw,  and  Abu  al  Khasib.  ISF  has 
maintained  high  visibility  throughout  both  the  city  and 
province  since  operations  began,  according  to  analysis  of 
imagery. 

113.  (S//REL  TO  USA,  AUS,  CAN,  GBR,  NZL ) Imagery  analysis  and 
DoD  reporting  indicate  the  Basrah  Khorramshahr  Port  of  Entry 
(POE)  --  the  closest  land-based  border  crossing  to  the  city 
of  Basrah  — has  been  closed  to  vehicular  traffic  since  the 
beginning  of  the  operation,  to  prevent  weapons  and  insurgent 
smuggling  from  Iran.  Multi-National  Division  Southeast 
reports  the  closure  of  the  POE  has  helped  stem  the  flow  of 
weapons  from  Iran  into  the  city. 

114.  (S//REL  TO  USA,  AUS,  CAN,  GBR)  The  monthly  attack  average 
since  the  operation  is  significantly  less  than  the  monthly 
attack  average  of  the  three  months  preceding  the  start  of  the 
operations.  Since  April  1,  analysis  shows  a change  in 
geographic  distribution  in  points  of  origin  for  IDF  attacks 
from  inside  the  city  of  Basrah  to  the  outskirts  of  the  city. 
Such  a shift  indicates  the  operation  was  successful  in 
curbing  attacks  in  the  city,  probably  driving  militants  out 

of  the  city  center. 

115.  (S//REL  TO  USA,  AUS,  CAN,  GBR,  NZL)  The  number  of  IDF 
attacks  against  Basrah  International  Airfield  has  dropped 
significantly  since  Operation  Charge  of  the  Knights.  However, 
DoD  reporting  indicates  the  insurgents  who  recently  trained 
in  Iran  are  attempting  to  re-enter  Iraq  via  the  Basrah 
Khorramshahr  POE.  When  the  Basrah  Khorramshahr  POE  reopens  to 
vehicular  traffic,  IDF  attacks  on  the  airfield  will  likely 
increase,  because  insurgents  who  fled  security  operations  in 
Basrah  may  return,  and  weapons  will  be  more  easily  smuggled 
from  Iran.  Because  the  POE  is  only  20  km  east  of  the  city, 
there  is  a strong  likelihood  that  militants  using  this  POE 
will  return  to  the  city  of  Basrah  to  carry  out  attacks  on  the 
airfield.  (Please  see  imagery  on  pages  5-6).  (Appendix  source 
1) 

116.  (U)  Significant  Events 

117.  (SBU)  WHA  - Brazil  - U.S.  Embassy  Brasilia  received  a 
suspicious  letter  October  30  mailed  from  Lap,  Sao  Paulo.  The 
letter  was  opened  in  the  weapons  of  mass  destruction  mailroom 
facility  where  it  revealed  a typed  letter  to  all  people  of 
the  world  concerning  the  powers  the  divine  God  of  Chyren.  The 
letter,  with  dried  blood  smeared  on  the  pages,  talked  about 
the  future  of  the  world  and  the  apocalypse;  however,  most  of 
the  letter  was  impossible  to  understand.  There  was  no 
evidence  of  pathogens  or  other  substances  in  the  envelope,  so 
mailroom  operations  returned  to  normal.  The  RSO  will  pass  the 
information  to  the  Brazilian  Federal  Police  for  follow  up. 

(RSO  Brasilia  Spot  Report) 

1I_18.  (SBU)  EUR  - Lithuania  - U.S.  Embassy  Vilnius  received  a 
telephonic  bomb  threat  at  2:23  p.m.  on  October  30.  The  caller 
stated  (in  Lithuanian)  a bomb  was  going  to  explode  if  he  did 
not  get  $1  billion  dollars.  The  call  was  recorded  and 
reviewed  by  Embassy  security  elements.  Local  guard  assets 
searched  the  compound  and  Marines  at  Post  One  reviewed 
cameras;  nothing  was  found  out  of  place  on  the  compound.  The 
local  police  were  notified  to  investigate  further.  (RSO 
Vilnius  Spot  Report) 


11.1 9.  (SBU)  AF  - Democratic  Republic  of  Congo  - Emergency 
Action  Committee  (EAC)  Kinshasa  convened  October  30  to 
discuss  the  October  29  evacuation  of  USG  staff  and  the 
current  security  situation  in  the  eastern  region  of  the 
country.  The  EAC  recommended  continued  travel  restrictions  to 
eastern  Democratic  Republic  of  Congo  (DRC)  and  that  all 
Mission  staff  remain  in  Gisenyi  until  further  notice.  The 
U.S.  Embassy  remains  concerned  about  the  potential  for 
violent  demonstrations  within  Kinshasa,  especially  against 
the  United  Nations  in  the  DRC.  Post  officials  will  continue 
to  closely  monitor  the  situation  and  report  ongoing 
developments.  (Kinshasa  0952) 

1.20.  (C)  Djibouti  - EAC  Djibouti  met  on  October  30  to  discuss 
the  attacks  in  Hargeysa,  Somaliland,  and  Bossaso,  Puntland. 

EAC  members  agreed  the  method  and  apparent  level  of 
coordination  of  the  attack  are  unprecedented  in  Somaliland. 

EAC  members  were  unaware  of  any  specific  threats  against  the 
U.S.  Embassy  or  U.S.  Citizens/interests  in-country;  however, 
members  noted  the  recommendation  of  Djiboutian  officials  to 
the  RSO  that  the  Embassy  increase  its  security  posture. 

Despite  the  proximity  of  the  Embassy  to  the  neighboring 
Ethiopian  Embassy  and  UN  compound,  the  EAC  assesses  the 
Djiboutian  Government,  despite  its  limited  resources,  will 
fully  support  Post  in  any  emergency  situation.  The  Embassy 
has  been  at  a heightened  security  level  since  the  September 
17  attack  on  Embassy  Sana, a in  Yemen.  (Appendix  source  2) 

1.21.  (S//NF)  Sudan  - On  September  29,  the  Sudanese  Ministry  of 
Foreign  Affairs  informed  the  U.S.  charg  d, affairs  that  the 
Government  of  Sudan  (GoS)  would  not  allow  an  Embassy  trip  to 
Nyala  and  a joint  United  Nations  African  Union  Mission  in 
Darfur-USG  trip  to  East  Jebel  Marra,  Darfur,  scheduled  for 
September  30.  This  denial  came  after  a week  of  submitting 
three  diplomatic  notes,  high-level  discussions  between 
multiple  USG  representatives,  and  even  the  Embassy, s prompt 
response  to  the  unusual  request  for  information  about  the 
airplane, s flight  crew.  While  this  is  not  the  first  time  the 
GoS  has  denied  USG  travel,  it  illustrates  a number  of 
realities  about  the  nature  of  the  GoS,  its  strategy  in 
dealing  with  the  international  community,  and  its  paranoia 
about  more  exposure  to  the  troubled  region  of  Darfur. 

(Appendix  source  3) 

1.22.  (S//NF)  EAP  - Burma  - EAC  Rangoon  met  October  30  to 
discuss  arrangements  for  the  upcoming  election  night  events. 
The  RSO  advised  he  will  request  host-nation  security  support 
for  the  event;  deploy  additional  local  guards;  make  all  the 
security  arrangements;  and  continue  to  liaise  with  Government 
of  Burma  security  offices  for  the  latest  intelligence 
concerning  any  threat  to  the  event.  (Appendix  source  4) 

1.2  3.  (SBU)  China  - On  October  2 7 at  2 p.m.,  Immigration  and 
Customs  Enforcement  (ICE)  Beijing  reported  a fire  had  broken 
out  in  the  computer  server  room.  The  office  is  located  on  the 
17th  floor  of  the  Silver  Tower.  The  fire  was  limited  to  the 
computer  server  room,  but  smoke  affected  the  entire  office 
and  could  be  smelled  throughout  much  of  the  building.  All  ICE 
employees  were  accounted  for.  Two  ICE  and  one  Customs  and 
Border  Protection  American  direct  hires  suffered  from  smoke 
inhalation  and  were  transported  to  Peking  University  Hospital 
for  treatment.  The  server  room  was  heavily  damaged,  with  many 
pieces  of  equipment  charred  or  melted.  The  local  fire 
department  is  conducting  an  investigation  of  the  fire.  The 
ICE  offices  will  remain  closed  pending  damage  estimates  and 
developments  in  the  investigation.  The  server  room  supported 
all  USG  offices  located  in  the  Silver  Tower  office  building. 
The  U.S.  Embassy  staff  is  developing  work-arounds  for 
providing  services  to  affected  offices.  (Beijing  4098) 

1.2  4.  (SBU)  SCA  - India  - EAC  Kolkata  convened  October  30  to 
discuss  multiple  bomb  blasts  in  Assam  State.  At  the  time  of 
this  writing,  as  many  as  12  blasts  occurred  almost 
simultaneously  in  Assam, s capital  of  Guwahati  and  towns  to 
the  north,  including  Kokrajhar,  Barpet,  and  Bonbaigaon. 
Currently,  all  known  AmCits  in  the  region  have  been  accounted 
for,  and  a DoD  contingency  group  working  in  northeast  Assam 
and  Arunchal  Pradesh  has  been  contacted  and  is  safe.  The  EAC 


discussed  the  ongoing  violence  and  unpredictability,  and 
agreed  a new  travel  restriction  to  Assam  should  be  imposed 
for  USG  employees  and  their  family  members.  The  EAC  also 
approved  a Warden  Message  addressing  the  situation  in  Assam. 
(Kolkata  0300) 

112  5.  (U)  Key  Concerns 

126.  (//GBR  S//FVEY ) EUR  - Turkey  - KGK  reportedly  preparing 
attack:  Tearline  released  October  30  indicates  a Kongra-Gel 
(KGK)  commander  has  issued  instructions  for  KGK  operatives  to 
carry  out  attacks  targeting  associates  of  the  conservative 
Nationalist  Movement  Party  as  well  as  state  personnel. 
Additionally,  KGK  has  been  transferring  personnel  to  the 
Adana,  Mersin,  and  Amanoslar  regions,  with  the  aim  of 
carrying  out  attention-grabbing  attacks  and  to  act  as 
reinforcements.  DS/TIA/ITA  notes,  while  this  threat  stream 
has  been  developing  for  some  time,  and  KGK  threats  this  time 
of  year  and  in  these  locations  are  not  unusual,  the 
information  indicating  the  transfer  of  personnel  to  Adana  — 
a city  with  a developed  Western  tourist  infrastructure,  a 
U.S.  diplomatic  presence,  and  a major  U.S.  military  base  with 
more  than  5,000  personnel  — is  troublesome;  additionally, 
Mersin  is  another  nearby  city  with  a major  tourism  industry 
and  was  the  scene  of  a suicide  vehicle-borne  improvised 
explosive  device  earlier  this  year.  Although  U.S.  interests 
should  not  be  targeted  directly  by  any  KGK  attack,  it  is 
likely,  given  the  dense  nature  of  Adana  and  Mersin,  official 
American  personnel  may  be  in  the  vicinity  if  and  when  an 
attack  occurs,  and  collateral  damage  could  result.  (Appendix 
source  5 ) 

1.27.  (S//NF)  NEA  - Israel/Palestinian  Territories  - According 
to  Jordanian  General  Intelligence  Department  information,  an 
al-Qa,ida  operative  in  Lebanon  (linked  to  known  al-Qa,ida 
facilitator  ,Imad)  claimed  al-Qa,ida,s  plan  to  target 
Israel  would  be  a small  operation  because  the  poor  financial 
situation  is  insufficient  to  support  large  operations.  There 
is  no  further  information  on  timing,  methods,  or  targets  of 
this  operation. 

1.28.  (S//NF)  DS/TIA/ITA  notes,  while  reports  of  al-Qa,ida,s 
influence  in  Gaza  exist,  there  is  no  information  regarding 
definitive  attack  planning  targeting  Israel.  Prior  tearline 
information  reported,  SAccording  to  uncorroborated 
information  from  Middle  East  sources  in  September, 
al-Qa,ida,s  presence  was  reportedly  growing  in  the  Gaza 
Strip.  Al-Qai,da  was  thought  to  have  gotten  a start  in  the 
Gaza  Strip  as  early  as  2001  with  the  pro-Taliban 
demonstrations  and  rallies.  It  was  speculated  that  some  of 
the  more  extreme  Popular  Resistance  Committees  (PRC)  members 
began  adopting  the  al-Qa,ida  ideology  at  the  beginning  of 
1.2004.  By  2006,  al-Qa,ida  had  allegedly  taken  a more  tangible 
form  with  the  appearance  of  Jaysh  al-Islam,  a splinter  of  the 
PRC  group  that  was  thought  to  have  ties  to  al-Qa,ida 
facilitator  Ahmad  al-Mazlum.8  Previous  reporting  indicated  a 
small  number  of  individuals  affiliated  with  al-Qa,ida  in 
Gaza.  Reporting  from  mid-August  alleged  an  eight-person 
al-Qa,ida  cell  led  by  an  Egyptian  national  was  operating  in 
Gaza.  This  information  originated  with  the  Palestinian 
Mukhabarat  and  remains  uncorroborated.  The  arrest  of  six 
self-identified  al-Qa,ida  members  in  July  suggested 
influence  of  al-Qa,ida  in  Israel,  but  did  not  indicate  any 
actual  contact  with  al-Qa,ida  members,  with  the  exception  of 
a chat  room  conversation.  Prior  reporting  such  as  the 
unsubstantiated  claim  by  a Gaza-based  al-Qa,ida  sympathizer 
that  suicide  bombers  were  going  to  attack  U.S.  interests  in 
late  July  demonstrates  the  influence  of  al-Qa,ida  within 
Gaza  and  the  presence  of  sympathizers.  Recent  tearline 
information  indicates  a larger  al-Qa,ida  influence  and 
presence  in  the  Gaza  Strip  than  earlier  reporting. 

1.29.  (S//NF)  ,Abd  al-Aziz  al-Jammaz,  a.k.a.  Imad  aka 
Salman,  is  a known  Lebanon-based  al-Qa, ida-linked 
facilitator  and  operator  associated  with  the  hotbed  of 
extremist  activity  in  the,Ayn  al-Hilwah  Palestinian  refugee 
camp.  The  Saudi-born  Imad  is  suspected  of  involvement  in 
multiple  terrorist  operations,  including  attacks  against 


United  Nations  Interim  Forces  in  Lebanon. 


11.30 . (S//NF)  DS/TIA/ITA  further  notes  the  likelihood  of  an 

al-Qa, ida-linked  attack  in  Israel  increases  if  the  alleged 
growing  al-Qa, ida  presence  in  Gaza  is  successfully  combined 
with  the  experience  and  networks  of  foreign  extremists  such 
as  Imad.  However,  it  is  unlikely  a transnational  al-Qa, ida 
operation  within  Israel  would  be  &small,8  as  the  source  of 
this  report  contends.  Israel  presents  a difficult  operating 
environment,  and  the  subsequent  reaction  of  Israeli  security 
forces  would  likely  be  severe  — deterrent  factors  which 
suggest  any  extremist  operation  would  likely  be  commensurate 
in  size  to  the  risk.  Lacking  further  information  on  the 
ultimate  source  of  this  information  and  the  vague  nature  of 
the  threat,  the  credibility  of  this  threat  remains 
questionable.  (Appendix  sources  6-9) 

1.31.  (S//NF)  SCA  - Afghanistan  - NDS  officer  facilitating 
suicide  bombers  targeting  Westerners:  As  of  mid-October,  a 
purported  officer  of  the  Afghan  National  Directorate  of 
Security  (NDS)  named  Mustafa  was  facilitating  two  suicide 
bombers.  A sensitive  source  with  thirdhand  access  claimed 
that  one  of  the  bombers  intended  to  target  Westerners  or 
International  Security  Assistance  Forces  (ISAF)  elements  in 
Kabul.  The  second  bomber  wanted  to  target  the  Wardak  Province 
Provincial  governor  or  an  individual  named  Haji  Mosa. 

1.32.  (S//NF)  DS/TIA/ITA  name  checks  on  NDS  officer  Mustafa  and 
Haji  Mosa  were  inconclusive.  Insurgents  have  increasingly 
targeted  Western  civilians  this  year.  The  Afghanistan  NGO 
Safety  Office  notes  at  least  18  incidents  in  Kabul  Province 
this  year  in  which  insurgents  and  criminals  have  targeted 
non-governmental  organizations  (NGOs),  but  not  all  included 
foreign  nationals.  Compared  to  previous  years,  there  has  been 
a consistently  high  volume  of  incidents  against  foreigners 
and  an  increased  frequency  in  the  deliberate  targeting  of 
foreigners.  Most  recently  in  Kabul,  a female  Canadian 
journalist  was  kidnapped,  and  a female  British  aid  worker  was 
assassinated.  It  is  still  unclear  if  the  murder  of  the  two 
DHL  executives  by  a guard  last  weekend  was  due  to  personal 
grievances  or  a planned  criminal/insurgent  assassination. 
(Appendix  source  10) 

1.33.  (S//NF)  Pakistan  - Kidnapping  threat  against  unspecified 
targets  in  Islamabad:  Tearline  reports,  &As  of  late  October, 

a two-man  kidnapping-f or-ransom  team  had  been  dispatched  by 
Khyber  Agency,  Federally  Administered  Tribal  Areas  (FATA), 
Pakistan-based  Afridi  warlord  Mangal  Bagh  to  Islamabad,  with 
order (s)  to  kidnap  two  to  four  unidentified  persons.  The  only 
identifying  characteristic  of  one  of  the  targets  was  that  he 
was  a millionaire.  The  head  of  the  kidnapping  team  was  Ghazi 
Zinatullah  (variant:  Zeenatullah)  from  Bara,  Khyber  Agency, 
FATA.  Zinatullah, s assistant  was  Wahidullah  (variant: 
Waheedullah ) . Wahidullah  was  also  from  Bara. 8 

1.34.  (S//NF)  DS/TIA/ITA  notes  there  is  little  convincing 
reporting  indicating  Mangal  Bagh  and  his  supporters  have  the 
capability  to  operate  in  Islamabad.  Furthermore,  the  vague 
nature  of  this  report  renders  it  difficult  to  properly  vet; 
although,  name  checks  on  Ghazi  Zinatullah  and  Wahidullah  and 
their  variants  yielded  negative  results.  It  is  likely, 
however,  Bagh  and  his  network  have  the  capability  to  launch 
kidnapping  operations  in  Peshawar;  reporting  from 
mid-September  indeed  suggests  he  may  have  been  involved  with 
the  August  26  ambush  of  the  U.S.  Consulate  principal  officer 
in  Peshawar. 

135.  (S//NF)  That  said,  since  the  beginning  of  September,  four 

intelligence  reports  have  detailed  al-Qa, ida  and  Pakistani 
extremist  plots  to  kidnap  Westerners  in  Pakistan.  Reporting 
detailing  plots  in  Islamabad  suggests  kidnappers  planned  to 
target  the  F-6,  F-7,  and  F-ll  areas  of  Islamabad,  presumably 
since  they  are  neighborhoods  where  most  Western  foreigners 
reside.  (Appendix  sources  11-20) 

1.36.  (S//NF)  Pakistan  - Threat  to  U.S.  Consulate  Lahore  and 
unspecified  residence:  As  of  late  October,  the  al-Jihad  group 
led  by  Sajid  Ullah  Moavia  planned  to  attack  U.S.  Consulate 


Lahore  with  shoulder-fired  rockets  from  the  rooftops  of 
nearby  high-rise  buildings.  The  group,  likely  linked  to 
al-Qa,ida,s  Usama  al-Kini,  also  planned  to  attack  an 
unspecified  residence  on  Zafar  Ali  Road  in  Lahore. 

11.37.  (S//NF)  Although  this  information  is  likely  circular  in 
nature,  DS/TIA/ITA  judges  al-Qa,ida  and  its  affiliates  are 
actively  targeting  Western  interests  in  Lahore,  including  the 
U.S.  Consulate  and  organizations,  entities,  or  venues 
associated  with  the  United  States.  Tearline  from  late 
September  warned,  &Terrorists  were  reportedly  targeting  the 
U.S.  Consulate  in  the  Punjab  Province  for  suicide  bombings 
and  sniper  attacks  in  late  September.  Extremists  were 
planning  to  target  the  Lahore  Consulate  for  suicide  bombings 
using  explosive-laden  cars  or  suicide  vests  as  well  as 
snipers  to  shoot  Americans  driving  out  of  the  compound. 8 

11.38.  (S//NF)  While  reporting  detailing  threats  to  Western 
interests  in  Pakistan  has  increased  following  the  September 
20  attack  against  the  Marriott,  earlier  reporting  regarding 
threats  to  Lahore  is  of  particular  concern  due  to  its 
credibility  and  the  demonstrated  capability  of  terrorists  to 
repeatedly  carry  out  attacks  in  the  city.  Sensitive  reporting 
from  late  July  reported  terrorists  planned  to  attack  U.S. 
organizations  in  Lahore.  Likewise,  Pakistani  security 
services  arrested  four  suspects  linked  to  senior  al-Qa,ida 
operative  Usama  al-Kini  (Terrorist  Identities  Datamart 
Environment  (TIDE)  number  48128)  in  late  July  who  plotted 
&large-scale8  attacks  in  the  Punjabi  capital  and  maintained 

a list  of  addresses  of  VIPs  — including  officers  of  the 
Federal  Investigative  Agency,  the  police,  and  political 
leaders  — their  routes,  and  a full  schedule  of  their 
engagements . 

11_39.  (S//NF)  Name  checks  on  Sajid  Ullah  Moavia  yielded 
inconclusive  results;  although,  it  may  reference  Ismatullah 
Mauvia  (TIDE  number  10541403),  who  is  reportedly  a leader  of 
a Jaish-e-Mohammed  splinter  group  that  is  currently  part  of 
Usama  al-Kini, s network.  It  is  unclear  if  this  splinter 
group  is  known  as  al- Jihad.  Al-Jihad  is  also  the  name  of  an 
infamous  Egyptian  Islamic  extremist  group  active  since  the 
1970s  that  targeted  high-level  Egyptian  Government  officials 
for  attack.  (Appendix  sources  21-31) 

11.4  0 . (U)  Cyber  Threats 

11.41.  (U)  England  - Establishing  new  agencies  to  fight  cyber 
crime : 

11.42.  (U)  Key  highlights: 

A recent  study  on  cyber  crime  incidents  ranked  the  UK 
second  behind  the  U.S. 

The  UK,s  NFRC  is  anticipated  to  begin  operations  in  2009. 

A police  force  specializing  in  cyber  crime  will  operate  in 
support  of  the  NFRC. 

The  threat  of  cyber  crime  is  receiving  increased  global 
recognition . 

11.4  3.  (U)  Source  paragraph:  &A  new  agency  of  the  Attorney 

General, s Office,  the  National  Fraud  Strategic  Authority 
(NFSA) , has  been  established  today  (October  1)  to  increase 
protection  for  the  UK  economy  from  the  harm  caused  by  fraud 
through  the  creation  of  a more  hostile  environment  for 
fraudsters,  both  at  home  and  abroad. 8 

11.4  4.  (U)  CTAD  comment:  According  to  a survey  commissioned  in 
2007  by  security  software  company  AVG  Technologies,  43 
percent  of  Britons  feel  more  at  risk  for  cyber  theft  than 
other  crimes  including  burglary,  assault,  and  robbery.  Of  the 
individuals  polled,  one  in  three  had  experienced  theft  over 
the  Internet  by  way  of  tactics  such  as  spear-phishing  e-mail 
messages  and  credit  card  fraud.  In  a separate  study  conducted 
by  online  identity  firm  Garlik,  cyber  crime  in  the  UK  rose  by 
more  than  9 percent  that  year,  with  more  than  250,000 
reported  incidents  of  online  financial  fraud  alone.  Fears 
about  cyber  crime  expressed  by  citizens  of  the  UK  are 
certainly  valid,  as  the  country  has  risen  to  the  rank  of 
second  place  behind  the  U.S.  in  number  of  reported  cyber 


crimes . 


1.45.  (U)  CTAD  comment:  To  assist  in  stifling  the  rise  of  cyber 
crime  incidents  in  the  UK,  the  Attorney  General, s Office  has 
announced  the  establishment  of  the  NFSA  tasked  to  &work  with 
private,  public,  and  third-sector  organizations  to  initiate, 
coordinate,  and  communicate  counter-fraud  activity  across  the 
economy. 8 Furthermore,  plans  are  also  underway  for  a 
National  Fraud  Reporting  Center  (NFRC)  anticipated  to  begin 
operations  in  2009.  The  NFRC  will  function  as  a central  point 
of  contact  for  reporting  e-crime,  as  well  as  an  entity 
responsible  for  the  organization  of  strategy  for  mitigating 
cyber  incidents.  A variety  of  online  offenses  will  be  handled 
by  this  agency,  to  include  credit  card  theft,  phishing,  and 
hacking.  In  order  to  facilitate  the  coordination  of 
nationwide  investigations  and  bring  together  reports  from 
victims  of  cyber  crime  across  the  UK,  the  NFRC  will  provide  a 
telephone  and  Web-based  reporting  service  that  will  Senable 
individuals  and  companies  to  share  information  on  reports  of 
fraud  and  receive  advice  and  information  to  protect 
themselves  from  future  attacks . 8 

146.  (U)  CTAD  comment:  In  addition  to  the  NFRC,  the  UK 
Government  plans  to  subsidize  a new  organization  dubbed  the 
Police  Central  e-crime  Unit  (PCeU).  The  PCeU,s  mission  will 
be  focused  on  the  investigation  of  cyber  crimes  and  Internet 
fraud  and  will  operate  in  support  of  the  NFRC.  As  part  of  the 
UK,s  national  offensive  against  cyber  crime,  the  PCeU  will 
also  collaborate  with  other  police  forces  and  crime-fighting 
agencies  in  operations  concerning  international  and  organized 
crime  on  the  Internet. 

147.  (U)  CTAD  comment:  The  omnipresent  cyber  threat  is 
garnering  increased  attention  on  a global  scale,  with  focus 
turning  toward  better  understanding  ways  to  mitigate  illicit 
activity.  Initiatives  such  as  those  instituted  by  the  UK  as 
well  as  the  establishment  of  transnational  endeavors  such  as 
the  International  Multilateral  Partnership  Against 
Cyber-Terrorism  — of  which  the  U.S.  is  a participant  (see 
CTAD  Daily  Read  File  dated  June  9)  — highlight  the  global 
awareness  of  the  need  for  the  development  of  systems  and 
policies  designed  to  defend  against  malicious  cyber 
operations.  Continued  progress  in  this  arena  could  aid  in  the 
creation  of  focused  channels  for  global  reporting  of 
cybercrime,  which  may  lead  to  increased  insight  for  law 
enforcement  and  intelligence  communities  into  the  tactics, 
techniques,  procedures,  and  motivations  of  cyber  threat 
actors.  (UK  Attorney  General, s Office  News  Release,  &UK 
Toughens  Up  on  Fraudsters  with  New  Anti-Fraud  Authority, 8 
October  1,  2008) 

1.48.  (U)  Suspicious  Activity  Incidents 

1.49.  (SBU)  WHA  - Barbados  - Surveillance  Detection  Team  (SDT) 
Bridgetown  observed  a man  near  the  New  Embassy  Compound  (NEC) 
October  28.  He  appeared  to  be  paying  close  attention  to  the 
people  exiting  the  visa  section.  (SIMAS  Event: 
Bridgetown-00809-2008 ) 

1.50.  (SBU)  Barbados  - SDT  Bridgetown  observed  a man  near  the 
NEC  October  29.  The  man  appeared  to  be  paying  close  attention 
to  the  people  exiting  the  visa  section.  He  carried  a digital 
camera  and  two  cell  phones.  The  man  departed  the  area  after 
approximately  20  minutes.  (SIMAS  Event:  Bridgetown-00810-2008) 

1.51.  (SBU)  Bolivia  - SDT  La  Paz  observed  a man  photographing 
the  front  of  the  U.S.  Embassy  October  27.  The  man  then 
departed  the  area  walking  north.  (SIMAS  Event:  La 
Paz-00328-2008) 

1.52.  (SBU)  Brazil  - SDT  Recife  observed  a man  across  the 
street  from  the  U.S.  Consulate  at  2:20  p.m.  on  October  27. 

The  man  appeared  to  be  attempting  to  hide  behind  a lamp  post 
while  looking  toward  Post.  After  approximately  10  minutes,  he 
departed  the  area.  At  4:30  p.m.,  the  man  walked  down  the 
street  in  front  of  the  Consulate,  looking  toward  the  Mission 
as  he  walked.  (SIMAS  Event:  Recife-01014-2008) 


11.53.  (SBU)  Honduras  - SDT  Tegucigalpa  observed  a man  standing 
on  the  sidewalk  near  the  U.S.  Embassy  October  17.  The  man 
observed  the  gate  to  the  Consular  area.  Local  Guard  Force 
(LGF)  personnel  interviewed  the  man,  who  refused  to  give  his 
name.  After  approximately  20  minutes,  he  departed  the  area  in 
a Mazda  pickup  truck. 

1.54.  (SBU)  Record  Check/Investigation:  Vehicle:  Gray  Mazda 
pickup  truck  (two  door);  License  plate:  PAP-7192  (Honduras). 
(SIMAS  Event:  Tegucigalpa-00276-2008) 

1.55.  (SBU)  Peru  - SDT  Lima  observed  a woman  near  the 
visitor, s entrance  of  the  U.S.  Embassy  October  28.  She  was 
approached  by  a local  police  officer  and  told  to  move.  Half 
an  hour  later,  she  was  observed  again  near  Post,s  visitor, s 
entrance.  LGF  and  police  personnel  interviewed  the  subject, 
who  stated  she  was  waiting  for  a friend  who  was  inside  the 
Embassy.  After  approximately  25  minutes,  she  departed  the 
area  in  a taxicab  without  meeting  anyone. 

1.56.  (SBU)  Record  Check/Investigation:  Subject:  Maribel 
Julissa  Leandro  De  Los  Reyes.  Identification  number: 

107508366.  (SIMAS  Event:  Lima-04360-2008) 

157.  (SBU)  EUR  - Germany  - A suspicious  individual 
photographed  with  his  cell  phone  camera  up  and  down 
Marbachweg  Street  and  Homburger  Landstrasse  in  Frankfurt 
October  2 . 

158.  (SBU)  RSO  Action/Assessment:  This  is  an  initial  sighting 
of  the  subject.  The  route  he  was  photographing  is  of 
considerable  concern,  as  it  is  the  primary  route  between  the 
Mission  housing  area  and  the  U.S.  Consulate  General.  (SIMAS 
Event:  Frankfurt-00518-2008) 

159.  (SBU)  Germany  - A suspicious  bicycle  with  a plastic  bag 
in  its  basket  was  parked  at  a bus  stop  close  to  U.S. 

Consulate  General  Frankfurt  housing  September  9.  The  bicycle 
was  checked  with  negative  results.  The  following  day,  the 
bike  was  gone. 

160.  (SBU)  RSO  Action/Assessment:  Mission  personnel  use  this 
bus  stop  as  a primary  transit  route.  (SIMAS  Event: 
Frankfurt-00509-2009 ) 

161.  (SBU)  Spain  - Three  Middle  Eastern-appearing  men  sat  on  a 
bench  in  front  of  the  U.S.  Ambassador, s residence  in  Madrid 
October  21.  A member  of  the  Ambassador, s security  detail 
noticed  the  subjects,  who  departed  the  area  on  foot  after  20 
minutes.  (SIMAS  Event:  Madrid-00437-2008) 

162.  (SBU)  EAP  - Malaysia  - SDT  Kuala  Lumpur  observed  two 
Middle  Eastern-appearing  men  in  front  of  the  U.S.  Embassy  at 
3:14  p.m.  on  October  29.  They  photographed  each  other  along 
the  street  in  front  of  Post.  After  approximately  5 minutes, 
they  departed  toward  the  south  and  entered  the  Iranian 
Embassy  at  3:32  p.m.  (SIMAS  Event:  Kuala  Lumpur-00661-2008) 

163.  (SBU)  Vietnam  - SDT  Ho  Chi  Minh  City  observed  a man 
across  the  street  from  the  U.S.  Consulate  General  October  29. 
The  man  took  notes  and  then  photographs  of  the  front  of  Post. 
The  man  departed  the  area  on  foot  after  approximately  5 
minutes.  (SIMAS  Event:  Ho  Chi  Minh  City-00320-2008) 

164.  (SBU)  SCA  - Pakistan  - SDT  Lahore  observed  a man  sitting 
in  a rickshaw  (three-wheeled  taxi)  parked  near  the  access 
road  to  the  U.S.  Consulate  October  16.  The  man  watched 
Post,s  access  road  and  turned  away  two  potential  customers. 
Local  police  interviewed  the  subject,  who  stated  he  did  not 
take  either  of  the  potential  customers  because  he  did  not 
know  the  location  of  their  intended  destinations.  After 
approximately  30  minutes,  he  departed  the  area. 

165.  (SBU)  Record  Check/Investigation:  Subject:  Habib  Ahmed 
Bhatti.  National  identification  card  number: 

35202-808057276-5.  (SIMAS  Event:  Lahore-00683-2008) 

166.  (SBU)  Pakistan  - SDT  Lahore  observed  a man  on  a bicycle 


near  the  access  road  to  the  U.S.  Consulate  October  16.  The 
man  observed  the  vehicles  passing  by  and  talked  on  his  cell 
phone.  The  local  police  interviewed  him,  and  he  stated  he  was 
waiting  for  his  friend.  The  man  departed  the  area  after 
approximately  30  minutes. 

Vol . (SBU)  Record  Check/Investigation:  Subject:  Mohammad  Din. 
National  identification  number:  35202-2845350-1.  (SIMAS 
Event:  Lahore-00692-2008) 

11_68.  (SBU)  Pakistan  - SDT  Karachi  observed  a man  sitting  on 
the  sidewalk  near  an  access  gate  to  one  of  the  U.S.  Consulate 
General  residential  housing  compounds  October  19.  After 
approximately  20  minutes,  the  man  departed  the  area.  (SIMAS 
Event:  Karachi-00277-2008) 
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